Skip to contentPi-hole Pi-hole vulnerabilities
- pi-holePi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlinkCVE-2026-1193367.8 High
- pi-holePi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypassCVE-2026-1193357.8 High
- pi-holePi-hole: file:// adlist read check and curl can resolve different filesCVE-2026-1193342.2 Low
- pi-holePi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`CVE-2026-501308.8 High
- pi-holePi-hole: Local privilege escalation via config-controlled path in root-executed service hooksCVE-2026-414898.8 High
- pi-holePi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).CVE-2026-337276.4 Medium
- com.ritense.valtimo web, pi-hole +1 morePi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command ExecutionCVE-2025-34087Public exploit9.0 Critical
- pi-holePi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the...CVE-2024-44069Disputed7.5 High
- pi-holePi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)CVE-2024-34361Public exploit8.6 High
- pi-holePihole Authenticated Arbitrary File Read with root privilegesCVE-2024-28247Public exploit7.6 High
- pi-hole pi-hole/adminlte, web interface +1 moreCross-site Scripting (XSS) - Reflected in pi-hole/adminlteCVE-2021-38126.7 Medium
- pi-hole pi-hole/adminlte, web interface +1 moreCross-site Scripting (XSS) - Reflected in pi-hole/adminlteCVE-2021-38116.7 Medium
- pi-hole pi-hole/adminlte, web interface +1 moreSensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlteCVE-2021-37067.4 High
- pi-hole, pi-hole adminlte +1 moreStored XSS Vulnerability in the Pi-hole WebinterfaceCVE-2021-327935.7 Medium
- pi-hole, pi-hole adminlte +1 more(Authenticated) Remote Code Execution Possible in Web Interface 5.5CVE-2021-32706EPSS 60.2%7.6 High
- pi-hole, pi-hole web interface, adminlte +1 more +3 moreStored DOM XSS in Pi-hole Admin Web InterfaceCVE-2021-294487.6 High
- pi-holeMultiple Privilege Escalation Vulnerabilities PiholeCVE-2021-29449Public exploit6.3 Medium
- pi-holePi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is...CVE-2020-355925.4 Medium
- pi-holePi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new...CVE-2020-355915.4 Medium
- pi-holeThe DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the...CVE-2020-356596.1 Medium
- pi-holeAn issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to...CVE-2020-141627.8 High
- pi-holePi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges...CVE-2020-126207.8 High
- pi-holePi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by...CVE-2020-149717.8 High
- pi-hole adminlte, pi-hole +1 morePi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via...CVE-2020-8816In KEVPublic exploitEPSS 78.3%9.1 Critical
- pi-holeThe Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary...CVE-2020-11108Public exploitEPSS 78.3%8.8 High
- pi-holePi-Hole 4.3 allows Command Injection.CVE-2019-13051Public exploitEPSS 12.5%8.8 High